Extracted

• • Target
    Invoice Doc_20260422_113307734.JS
  • Size 3.1MB
  • SHA256 87c2ed42b14603544d6ba397f3fadb5eaeb4edf3d7bc02f1c69fa79a0800916b
  • MD5 acd92a41a2cd51ef59fcd539fb2e4611
  • SHA1 8ac00f19d779cd49c06ab75f148e6822a16c1337
  • SHA512 2c4bf04f7fa71a4261c2b437244e193e8d9d83ea8f5891b927325644732b2019f609fd2b2d815a84d21abf087ce6ea4e4dbf472cbfdd5cfdd47b97241e5be53c
  • SSDEEP 98304:I7dWiYlFMxRvE/BZnEuFD7/wpKYpJMcHX2nQzN1LoJi6I4Zhy7e:IW+cG/3GnwLGNhKe
  • TLSH
    T1D2E50744D228FB70A92E772EF873AA54761C214B5188EF3E74FC1244B792B27578D8D2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2